Eight Friends Are Enough: Social Graph Approximation via Public Listings

Transcription

1 Eight Friends Are Enough: Social Graph Approximation via Public Listings ABSTRACT Joseph Bonneau Fran Stajano The popular social networing website Faceboo exposes a public view of user profiles to search engines which includes eight of the user s friendship lins. We examine what interesting properties of the complete social graph can be inferred from this public view. In experiments on real social networ data, we were able to accurately approximate the degree and centrality of nodes, compute small dominating sets, find short paths between users, and detect community structure. This wor demonstrates that it is difficult to safely reveal limited information about a social networ. Categories and Subject Descriptors K.4.1 [Computers and Society]: Public Policy Issues Privacy; E.1 [Data Structures]: Graphs and networs; F.2.1 [Analysis of Algorithms and Problem Complexity]: Numerical Algorithms and Problems; K.6.5 [Management of Computing and Information Systems]: Security and Protection General Terms Security, Algorithms, Experimentation, Measurement, Theory, Legal Aspects Keywords Social networs, Privacy, Web crawling, Data breaches, Graph theory 1. INTRODUCTION The proliferation of online social networing services has entrusted massive silos of sensitive personal information to social networ operators. Privacy concerns have attracted Permission to mae digital or hard copies of all or part of this wor for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. SNS 09 Nuremberg, Germany Copyright 2009 ACM $5.00. Jonathan Anderson jra40@cl.cam.ac.u Ross Anderson rja40@cl.cam.ac.u considerable attention from the media, privacy advocates and the research community. Most of the focus has been on personal data privacy: researchers and operators have attempted to fine-tune access control mechanisms to prevent the accidental leaage of embarrassing or incriminating information to third parties. A less studied problem is that of social graph privacy: preventing data aggregators from reconstructing large portions of the social graph, composed of users and their friendship lins. Knowing who a person s friends are is valuable information to mareters, employers, credit rating agencies, insurers, spammers, phishers, police, and intelligence agencies, but protecting the social graph is more difficult than protecting personal data. Personal data privacy can be managed individually by users, while information about a user s place in the social graph can be revealed by any of the user s friends. 1.1 Faceboo and Public Listings Faceboo is the world s largest social networ, claiming over 175 million active users, maing it an interesting case study for privacy. Compared to other social networing platforms, Faceboo is nown for having relatively accurate user profiles, as people primarily use Faceboo to represent their real-world persona [10]. Thus, Faceboo is often at the forefront of criticism about online privacy [2, 17]. In September 2007, Faceboo started maing public search listings available to those not logged in to the site an example is shown in Figure 1. These listings are designed to encourage visitors to join by showcasing that many of their friends are already members. Originally, public listings included a user s name, photograph, and 10 friends. Showing a new random set of friends on each request is clearly a privacy issue, as this allows a web spider to repeatedly fetch a user s page until it has viewed all of that user s friends 1. In January 2009, public listings were reduced to 8 friends, and the selection of users now appears to be a deterministic function of the requestin IP address 2. 1 Retrieving n friends by repeatedly fetching a random sample of size is an instance of the coupon collector s problem. It will tae an average of n Hn = Θ( n log n) queries to retrieve the complete set of friends. A set of 100 friends, for example, would require 65 queries to retrieve with = 8. 2 Using the anonymity networ Tor, we were able retrieve dif- 1

2 Networ #Users Mean d Median d Max d Stanford 15, ,246 Harvard 18, ,213 Table 1: Summary of Datasets used. d = degree Figure 1: An author s public Faceboo profile Faceboo has also added public listings for groups, listing 8 members in a similar fashion. Critically, public listings are designed to be indexed by search engines, and are not defended technically against spidering. Members-only portions of social networs, in contrast, are typically defended by rate-limiting or legally by terms of use. We have experimentally confirme the ease of collecting public listings, writing a spidering script which retrieved 250,000 listings per day from a destop computer. This suggests roughly 800 machine-days of effort are required to retrieve the public listing of every user on Faceboo, easily within the ability of a serious aggregator. Thus the complete collection of public listings can be considered available to motivated parties. 1.2 Privacy Implications Our goal is to analyse the privacy implications of easily available public listings. The existence of friendship information in public listings is troublesome in that it is not mentioned in Faceboo s privacy policy, which states only that: Your name, networ names, and profile picture thumbnail will be made available to third party search engines [1]. Furthermore, public listings are shown by default for all users. Experimenting with users in the Cambridge networ, we have found that fewer than 1% of users opt out. We feel this reflects a combination of user ignorance and poorly designed privacy controls, as most users don t want public listings the primary purpose is to encourage new members to join. Users who joined prior to the deployment of public listings may be unaware that the feature exists, as it is never encountered by members of the site whose browsers store cooies for automatic log-in. Leaing friendship information leads to obvious privacy concerns. Social phishing attacs, in which phishing s are forged to appear to come from a victim s friend, have been shown to be significantly more effective than traditional ferent sets of friends for the same user by sending requests from different IP addresses around the globe. We noticed a correlation between the set of friends shown and the geographic location of the requesting IP address. We suspect this is a mareting feature and not a security feature showing a visitor a group of nearby people maes the site more appealing. cold phishing [12]. Private information can be inferred directly from one s friend list if, for example, it contains multiple friends with Icelandic names. A friend list may also be checed against data retrieved from other sources, such as nown supporters of a fringe political party [19]. In this wor though, we evaluate how much social graph structure is leaed by public search listings. While we are motivated by the question of what data aggregators can extract from Faceboo, we consider the general question of what interesting properties of a graph one can compute from a limited view. We start with an undirected social graph G =< V, E >, where V is the set of vertices (users) and E is the set of edges (friendships). We produce a publicly sampled graph G =< V, E >, where E E is produced by randomly choosing outgoing friendship edges for each node v V. We then compute some function of interest f(g) and attempt to approximate it using another function f approx (G ). If f (G) f approx (G ), we say that the public view of the graph leas the property calculated by f. As, all information leas, so we are most concerned with low values of such as the current Faceboo value = 8. It is important to note that we assume E is a uniformly random sample of E. This may not be the case if Faceboo is specifically showing friends for mareting purposes. An interesting question for future wor is if there are public display strategies which would mae it harder to approximate useful functions of the graph. 2. EXPERIMENTAL DATA In order to obtain a complete subgraph to perform experiments on, we crawled data from a large social-networ using a special application to repeatedly query user data using the networ s developer API. On the social networ in question, we found that more than 99% of users had their information exposed to our application, maing this approach superior to crawling all profiles visible to a public networ, which is typically only 70-90% [14]. We crawled two sub-networs consisting of students from Stanford and Harvard universities, summarised in Table 1. We note that our crawling method is impractical for crawling significant portions of the graph, because we were subject to rate-limiting and the number of friendship queries required was O(n 2 ) as n, the number of users crawled, increased. Crawling public listings, as search engines are encouraged to do, is a much easier tas. 3. STATISTICS We studied five common graph metrics vertex degree, dominating sets, betweenness centrality, shortest paths, and community detection and found that even with a limited public view, an attacer is able to approximate them all with some success. 3.1 Degree Information about the degree d of nodes in the networ is exposed in the sampled graph, particularly for low-degree 2

3 nodes. This is not surprising, because nodes with d < must be shown with fewer than lins in their public listing, leaing their precise degree. For most social networs, however, finding the set of users with few friends is less interesting than finding the most popular users in the networ, who are useful for mareting purposes. Degree information is leaed for users with d because they will liely be displayed in some of their friends listings, meaning that there will be edges for most nodes in the sampled graph. We can consider the sampled graph to be a directed graph with edges originating from the user whose public listing they were found in. The out-degree d out(n) of a node n is the number of edges learned from its public listing, and the in-degree d in(n) is the number of edges learned from other public friend listings which include n. Note that we always have d out(n), but for a high degree node in the complete graph, we expect d in(n) >. We can mae a naive approximation of n s degree in the complete graph: d (n) max[d out(n), d in(n) d ] (1) where d is the average degree of all nodes in the complete graph (we assume this can be found from public statistics). This method wors because, for a node n with d(n) friends, n will show up in each friend m s listings with probability d(m). Since we don t now d(m), we can approximate with the average degree for the complete graph. This approximation, however, has an intrinsic bias, as nodes with many relatively low-degree friends will have an artificially high estimated degree. In a sampled graph, it is more meaningful for a node to have in-edges from a higher-degree node, conceptually similar to the PageRan algorithm [6]. Thus, we can improve our estimates by implementing an iterative algorithm: first initialise all estimates d 0(n) to the naive estimate of equation 1, and then iteratively update: d i(n) max[d out(n), X m in-sample(n) d i 1(m) ] (2) In order to eep the degree estimates bounded, it is necessary to normalise after each iteration. We found it wors well to force the average of all estimated degrees to be our estimated average d for the complete graph. To evaluate the performance of this approach, we define a cumulative degree function D(x), which is the sum of the degrees of the x highest-degree nodes. This is motivated by the liely use of degree information, to locate a set of very high-degree nodes in a networ. In in Figure 2, there is a comparison of the growth of D(x) when selecting the highest degree nodes given complete graph nowledge against our naive and iterated estimation algorithms. We also plot the growth of D(x) if nodes are selected uniformly at random, which is the best possible approach with no graph information. With = 8, the iterative estimation method wors very well; for the Harvard data set the highest-degree 1,000 nodes identified by this method have a cumulative degree of 407,746, compared with 452,886 using the complete graph, maing our approximation 90% of optimal. We similarly found 89% accuracy in the Stanford networ. 3.2 Dominating Sets A more powerful concept than simply finding high-degree Figure 2: Degree estimation methods nodes is to compute a minimal dominating set for the graph. A dominating set is a set of nodes N, such that its dominated set N friends(n) is the complete set of users V. In the case of a social networ, this is a set of people who are, collectively, friends with every person in the networ. Mareters can target a small dominating set to indirectly reach the entire networ. If an attacer can compromise a small dominating set of accounts, then the entire networ is visible. Even given the complete graph, computing the minimum dominating set is an NP-complete problem [13]. The simple strategy of picing the highest-degree nodes can perform poorly in social networs, as many high-degree users with overlapping groups of friends will be selected which add relatively little coverage. However, a greedy algorithm which repeatedly selects the node which brings the most new nodes into the dominated set has been shown to perform well in practice [7]. To evaluate this greedy approach, we measured the growth of the dominated set as additional nodes are added to the dominating set, if nodes are selected using the complete graph or the sampled graph. The greedy algorithm performs very well given the sampled view. In Figure 3 we compared these two selection strategies against a degree selection strategy of always picing the next highest-degree node (given complete graph nowledge). The greedy algorithm outperforms this approach even with only sampled data, demonstrating that significant networ information is leaed beyond an approximation of degrees 3. Our experiments showed that very small sets exist which dominate most of the networ, followed by a long tail of diminishing returns to dominate the entire networ, consistent with previous research [9]. With complete graph nowledge, we found a set of 100 nodes which dominate 65.2% of the Harvard networ, while we were able to find a set of 100 nodes giving 62.1% coverage using only the sampled graph, 3 In fact, we were surprised to find that selecting the highestdegree nodes based on our naive degree-estimates from the sampled graph outperformed selecting based on actual degree! This is because a bias in favor of nodes with low-degree friends is useful for finding a dominating set, as the graph s fringes are reached more quicly. 3

4 Figure 3: Dominating set estimation Figure 4: Message interception for 95% accuracy. Similarly, for Stanford, our computed 100-node dominating set had 94% of the optimal coverage. 3.3 Centrality and Message Interception Another important metric used in the analysis of social networs is centrality, which is a measure of the importance of members of the networ based on their position in the graph. We use the betweenness centrality metric, for which an efficient algorithm is described in [5]. Betweenness centrality is defined as: C B (v) = X s v t V σ st (v) σ st (3) where σ st is the number of shortest paths from node s to node t and σ st (v) is the number of such paths which contain the node v. Thus, the higher a node s betweenness centrality, the more communication paths it is a part of. A node with high betweenness centrality, therefore, is one which could intercept many messages travelling through the networ. We simulated such interception occurring on the Stanford sub-networ to determine the probability that an attacer controlling N nodes could intercept a message sent from any node to any other node in the networ via shortestpath social routes. The nodes designated as compromised are selected according to one of three policies: maximum centrality, maximum centrality for a sampled graph with = 8, or random selection. 4 shows that, while randomly selecting nodes to compromise leads to a linear increase in intercepted traffic, a selective targeting of highly central nodes yields much better results. After compromising 10% of nodes in this sub-networ, an attacer could intercept 15.2% of messages if she used random selection, but using centrality to direct the choice of nodes, the attacer can intercept as much as 51.9% of messages. Even if the attacer uses only the information available from a = 8 public listing, she can still successfully intercept 49.8% of all messages just 4% less than she could do with full centrality information. 3.4 Shortest Paths We tested the extent that the small world property is Figure 5: Reachable nodes maintained in a sampled graph by computing the minimum path length between every pair of nodes, using the Floyd- Warshall shortest path algorithm [11]. As this algorithm has a complexity of O ` V 3, where V is the set of vertices in a graph, we only calculated shortest paths a subset of our example data. Within the 2,000 most popular Stanford users, the minimum-length shortest path was a single edge and the maximum-length path was just three edges. Figure 5 shows the effect of limiting friendship nowledge on reachability of nodes in the graph. The maximum-length shortest path increases from 3 to 7 as we reduce visible friendships to 2 per person, but the graph remains fully connected. The average path length for Stanford was 1.94 edges, and with = 8, it increased to just Community Detection Given a complete graph, it is possible to automatically cluster the users into highly-connected subgroups which signify natural social groupings. Community structure in social graphs could be used to maret products that other members of one s social clique have purchased, or to identify dis- 4

5 strategies for placing a small set of nodes under surveillance to gain coverage of a larger networ, similar to our calculation of dominating sets. Related to our problem of limiting the usefulness of observable graph data is anonymising a social networ for research purposes. It has been shown that, due to the unique structure of groups withing a social graph, it is often easy to de-anonymise a social graph by correlating it with nown data [4]. Figure 6: Community Detection sident groups, among other applications. For our purposes, we will use attempt find communities with maximal modularity [16], a clustering metric for which efficient algorithms can partition realistically-sized social graphs with thousands of nodes. Modularity is defined to be the number of edges which exist within communities beyond those that would be expected to occur randomly: Q = 1 2m X v,w» A vw d(v)d(w) 2m where m is the total number of edges in the graph, and A vw = 1 if and only if v and w are connected. We implemented the greedy algorithm for community detection in large graphs described in [8]. The results on our sample graph were striing, as shown in Figure 6. With a sampling parameter of = 8, we were able to divide the graph into communities nearly as well as using complete graph nowledge. Using sampled data, we divided the graph into 18,150 communities with a modularity of 0.341, 92% as high as the optimal 18,205 communities with a modularity of The algorithm produced a slightly different set of communities using the sampled graph, because a well-connected social networ lie a college campus contains many overlapping communities, but using modularity as our metric, the communities identified were almost as significant. Community detection wored nearly as well with =5, but performance deteriorated significantly for =2 and below. 4. RELATED WORK Graph theory is a well-studied mathematical field; a good overview is available in [3]. Sociologists have long been interested in applying graph theory to social networs, the definitive wor is [18]. Approximating information from a social graph when presented with incomplete nowledge, however is far less studied. The closest example we could find in the literature was a study which evaluated community detection given only the edges from a small subset of nodes [15]. This wor used a different sampling strategy, however, and only aimed to classify nodes into one of two communities in a simulated graph. Another set of experiments [9] examined (4) 5. CONCLUSIONS We have examined the difficulty of computing graph statistics given a random sample of edges from each node, and found that many interesting properties can be accurately approximated. This has disturbing implications for online privacy, since leaing graph information enables transitive privacy loss: insecure friends profiles can be correlated to a user with a private profile. Social networ operators should be aware of the importance of protecting not just user profile data, but the structure of the social graph. In particular, they shouldn t assist data aggregators by giving away public listings. Acnowledgements We would lie to than George Danezis, Claudia Diaz, Eio Yonei, and Joshua Batson, as well as anonymous reviewers, for helpful discussions about this research. 6. REFERENCES [1] Faceboo privacy policy. (2009). [2] Acquisti, A., and Gross, R. Imagined Communities: Awareness, Information Sharing, and Privacy on the Faceboo. In Privacy Enhancing Technologies LNCS 4258 (2006), Springer Berlin / Heildelberg, pp [3] Albert, R., and Barabási, A.-L. Statistical mechanics of complex networs. Rev. Mod. Phys. 74, 1 (Jan 2002), [4] Bacstrom, L., Dwor, C., and Kleinberg, J. Wherefore art thou r3579x?: anonymized social networs, hidden patterns, and structural steganography. In WWW 07: Proceedings of the 16th international conference on World Wide Web (New Yor, NY, USA, 2007), ACM, pp [5] Brandes, U. A Faster Algorithm for Betweenness Centrality. Journal of Mathematical Sociology 25, 2 (2001), [6] Brin, S., and Page, L. The anatomy of a large-scale hypertextual web search engine. In Seventh International World-Wide Web Conference (WWW 1998) (1998). [7] Chvatal, V. A Greedy Heuristic for the Set-Covering Problem. Mathematics of Operations Research 4, 3 (1979), [8] Clauset, A., Newman, M. E. J., and Moore, C. Finding community structure in very large networs. Physical Review E 70, 6 (Dec 2004), [9] Danezis, G., and Wittneben, B. The economics of mass surveillance and the questionable value of anonymous communications. WEIS: Worshop on the Economics of Information Security (2006). 5

6 [10] Dwyer, C., Hiltz, S. R., and Passerini, K. Trust and privacy concern within social networing sites: A comparison of faceboo and myspace. America s Conference on Information Systems (2007). [11] Floyd, R. W. Algorithm 97: Shortest path. Communications of the ACM 5, 6 (1962), 345. [12] Jagatic, T. N., Johnson, N. A., Jaobsson, M., and Menczer, F. Social phishing. Commun. ACM 50, 10 (2007), [13] Karp, R. Reducibility Among Combinatorial Problems. Complexity of Computer Computations (1972). [14] Krishnamurthy, B., and Wills, C. E. Characterizing Privacy in Online Social Networs. In Worshop on Online Social Networs WOSN 2008 (2008), pp [15] Nagaraja, S. The economics of covert community detection and hiding. WEIS: Worshop on the Economics of Information Security (2008). [16] Newman, M. E. J., and Girvan, M. Finding and evaluating community structure in networs. Physical Review E 69 (2004), [17] Rosenblum, D. What Anyone Can Know: The Privacy Riss of Social Networing Sites. IEEE Security & Privacy Magazine 5, 3 (2007), 40. [18] Wasserman, S., and Faust, K. Social Networ Analysis. Cambridge University Press, [19] Xu, W., Zhou, X., and Li, L. Inferring privacy information via social relations. International Conference on Data Engineering (2008). 6